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Abstract 

This report summarizes the research effort by a team of researchers at West Virginia 
University in support of the NASA Intelligent Flight Control System (IFCS) F-15 program. In 
particular, WVU researchers assisted NASA Dryden researchers in the following technical tasks 
leading to piloted simulation of the ‘ Gen_2 ’ IFCS control laws. 

Task #1- Performance comparison of different neural network (NN) augmentation for the 
Dynamic Inversion (DI) -based VCAS ‘ Gen_2 ’ control laws. 

Task #2- Development of safety monitor criteria for transition to research control laws 
with and without failure during flight test. 

Task #3- Fine-tuning of the t Gen_2' control laws for cross-coupling reduction at post- 
failure conditions. 

Matlab/Simulink-based simulation codes were provided to the technical monitor on a 
regular basis throughout the duration of the project. Additional deliverables for the project were 
Power Point-based slides prepared for different project meetings. 

This document provides a description of the methodology and discusses the general 
conclusions from the simulation results. 
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1. Introduction 

The contribution of the West Virginia University (WVU) research team to the NASA 
Intelligent Flight Control System (IFCS) i Gen_2 ’ F-15 project between 3/1/2003 and 2/29/2004 
includes the following: 

1- Comparison of the performance of different neural network (NN) augmentation for the 
Dynamic Inversion (DI) - based control laws. 

An extensive simulation study has been performed 1 focused on comparing the 
performance of three different neural augmentations for the dynamic inversion-based control 
laws used for fault tolerant purposes on the NASA IFCS F-15 aircraft with the ‘ Gen_2 ’ research 
activities. Iin particular, the performance of the Extended Minimal Resource Allocating 
Networks (EMRAN) algorithm, the Single Hidden Layer (SHL) neural network, and the Sigma 
Pi (SP) neural network have been compared. The comparison has been conducted in terms of 
‘ad-hoc’ parameters relative to the tracking of desirable dynamic responses following the 
injection of simulated failures on the actuators of the right stabilator and the left canard of the 
NASA F-15 aircraft. The simulation results have shown that all three neural networks have 
promising performance with the Extended Minimal Resource Allocating Networks algorithm 
slightly outperforming the other algorithms. 

2- Development of safety monitor criteria for transition to research control laws with and 
without failure during flight test. 

Specific parameters have been identified and criteria have been defined for the 
development of a Safety Monitor (SM) scheme for safe transition to research control laws with 
and without failure during flight test. A SM scheme has been developed and tested 2 at WVU 
allowing the flight control system to switch from “nominal” mode to “research” mode. Within 
the “research” mode the research objectives are to investigate the performance of a neural 
network-based set of control laws for fault tolerant purposes. In a typical research aircraft, the 
“conventional” control laws are implemented on the “basic” flight computer (SC3) while 
research control laws - designed to provide fault tolerance capabilities - are housed on a research 
computer (ARTS2). Therefore, a safety logic scheme is needed to ensure a safe transition from 
the conventional to the research control laws at nominal conditions, as well as from the research 
control laws at nominal conditions to the research control laws with “simulated” failures on 
specific control surfaces. The SM scheme along with its logic for the different transitions have 
been designed using information relative to different parameters, such as flight conditions and 
controller-related performance criteria. The testing of the SM was performed through a 
customized interface with a detailed Simulink-based flight simulation code developed at WVU 
for the NASA IFCS- 15 aircraft 3 . Different levels of complexity of the SM scheme have been 
considered; the trade-offs between complexity and efficiency have been identified. 

3- Enhancement of the control laws to provide improved cross-coupling reduction at post-failure 
conditions. 

Pilot evaluation during ground simulator tests showed undesirable levels of cross 
coupling at post failure conditions. The introduction of ‘coupling terms’ in the cost function of 
the NNs has been investigated as a possible solution. Particularly, products of the angular rates 
and angular rate cross correlations have been considered as possible coupling terms to be added 
to the cost function. Simulation results showed a sensible decrease of the cross-coupling. 
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2. Performance of different neural network augmentation for the non-linear 
dynamic inversion (NLDI) - based control laws 


2.1. Introduction 

The main goal of the NASA IFCS F-15 program 5 is to develop and evaluate in flight 
control schemes allowing the pilot to cope with the occurrence of a primary control surface 
failure. The control laws considered here are based on a NLDI scheme augmented with a NN to 
compensate inversion errors and changes in aircraft dynamics due to damage or failure of 
primary control surfaces. The performance of three different NNs is investigated starting from a 
well-known architecture 6 ' 10 . The three NNs considered are: the Extended Minimal Resource 
Allocating Networks 11 (EMRAN) algorithm, the Single Hidden Layer 8 (SHL) NN, and the 
SigmaPi 1 . Their performance is compared in different simulations involving nominal flight 
conditions, as well as stabilator and canard failures. 


2.2. The Dynamic Inversion-Based Control Laws 

The general scheme is based on an adaptive neural controller canceling the errors 
associated with the dynamic inversion of the model. This control strategy 6 ' 8 has been selected to 
provide consistent handling qualities without requiring the level of computational effort 
associated with gain-scheduling and/or system identification. In addition, desired handling 
qualities are achieved with ‘ ad hoc ’ reference models. 

Flight commands are generated by the pilot through longitudinal and lateral stick ( S lonM , 

Sia , stick ) and pedals ( S Air , . ). These displacement commands are converted 6 ' 10 into corresponding 

roll, pitch, and yaw rate commands ( p com , q com , r com ). The reference model provides filtered rate 
commands ( p ref , q ref , r ref ) and acceleration commands ( p ref , q ref , r ref ) using first order roll rate 

and second order pitch and yaw rate transfer functions. 

The inputs to dynamic inversion (p c , q c , P) are computed using the expression: 
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where (U Pa/ , U qad , ) are augmentation commands generated by adaptive NNs in order to 

compensate for the estimated errors e p , e q , e r from the difference between reference and plant 
angular rates. Furthermore, the pseudo control acceleration commands (U p , u q , U r ) are 
computed with the following expressions: 
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where K p and K, are, respectively, proportional and integral constants. 

Dynamic inversion is then used to determine the necessary control surface deflections 
(S a ,S e ,S r ). Initially, control surface commands ( S Bam , 8 ecom , S r ^ ) are obtained with the 

following equation: 
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where B is the state space system control matrix and the terms ( p c -L ,, q c -M,, r c -N,) are the 
differences between input acceleration commands and actual plant acceleration contributions (£/, 
Mi, Ni). These plant contributions are fiinction of inertial and geometric characteristics, 
aerodynamic derivatives, angular rates, and aerodynamic angles. Finally, the control surface 
actual deflections are computed from 8 acom , S e , S ram in order to include the modeling of the 

actuator dynamics (first and second order transfer functions). 

2.3. The Extended Minimal Resource Allocating Networks Algorithm 

The first NN considered in this study is the Extended Minimal Resource Allocating 
Networks 11 (EMRAN) algorithm. The EMRAN algorithm is a more powerful version of the 
standard MRAN. The main architecture 13 features growing and pruning mechanisms; moreover, 
the parameters are updated following a “winner takes it all” strategy. The extended algorithm 
allows only the parameters of the most activated neurons to be updated, while all the others are 
left unchanged. In other words, the algorithm allocates resources (neurons) in order to decrease 
the estimation error in regions of the state space where the mapping accuracy is poor. This 
strategy implies a significant reduction of the number of parameters to be updated on-line; thus, 
it is particularly suitable for on-line applications 14 . 

For Gaussian basis functions the estimate is computed with the expression: 


y{x,6) 


M 


1—1 




l W 


( 6 ) 


where x is the input vector, 0 is the set of parameters to be tuned by the learning algorithm 
including the weight w, the gaussian center positions // , and the variances a . A new neuron is 
initiated if 3 distinct criteria are satisfied: the estimation error, the windowed estimation error, 
and the distance from the input to the nearest center must be larger than selected thresholds: 

e i (k) = y(k)-y(k)>E t (7) 

>E 2 ( 8 ) 
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If this is the case, the center, variance, and weight of the new neuron at iteration k are 
given by, respectively: 


i(k) = x(k) 

( 10 ) 


( 11 ) 
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When one of the criteria is not met, the tuning parameters are updated using the relationship: 
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whre e(k) is the estimation error and 77 is the learning rate. 

A combination of an ADALINE 15 and an EMRAN network (A+EMRAN) working in 
parallel has been implemented on each of the three channels. This approach has been adopted to 
achieve good performance in the presence of large non-linearities without the computational 
burden on operation in areas without non-linearities. 

2.4. The Single Hidden Layer Neural Network Algorithm 

The second neural algorithm considered in this effort is the Single Hidden Layer 6,7,8 
(SHL) NN. The output of the network is given by the relationship: 
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where w j} are the interconnection weights between the hidden layer and the output layer, v Jk are 
the interconnection weights between the input layer and the hidden layer, and 6 V] , are bias 
terms. The activation potential a is used to compute the activation function of the form: 

'<0-1^ <15) 

Based on a Lyapunov analysis the weights updating laws are given by 6,7,8 : 


W=-Yw [{a-a'V T x)e T x + V h\\w] 
V = -Y v [xe T x W T c+^\\e x \\v] 


where e x are state errors and YwYv,^w,^y are design parameters (learning rates and e- 
modification factors). 
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2.5. The Sigma Pi Neural Network 

The third and final neural algorithm investigated in this effort is a two-layer Sigma-Pi 
NN 9,10 ’ 11 for each angular acceleration ( p,q,r ). These NNs feature proportional and integral 
acceleration errors ( U p error , U qerTOr , U r error ) for on-line learning purpose: 
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(17) 


Inputs to the networks are pseudo control acceleration commands (U p , u q , U r ), bias 

terms, and sensor feedback. For each channel three terms C/, C 2 and C? are computed as 
functions of input variables and previous-step network outputs (u Pad , U Vad , U raj ): 


C lx = bias,V„V 2 ,h 

(18) 
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C 2r = bias, p, r,r^ 

(21) 

C ix = bias, a, P x = p,q,r 

(22) 


All the neuron outputs are summed and multiplied to each other - from which the name 
of the NN topology originates. The outputs of the NNs are the control augmentation commands 
defined as: 

U aj ^W T f(C l ,C 2 ,C 3 ) (23) 

where / is computed from each signal inputs using a nested Kronecker product. The network 
weights W are determined by an adaptation law: 

W=~G(U error f+L\U error \w) (24) 

where G and L are user selected specific gains. 

2.6. Results of the Comparative Study 

An extensive simulation study has been performed using the WVU IFCS F-15 ‘Gen_2’ 
flight simulator 3 . Only a subset of the simulation results are here presented for brevity purposes 
for illustrating the main conclusions. 

The simulations have been performed at Mach = 0.75 and altitude = 20000 ft., which is to 
be considered the single-point flight condition at which most of the research flight test 
maneuvers will be performed. Following interaction with the technical monitor, 6 specific test 
cases have been considered: 

Case #1: nominal conditions, no failure, doublets on all three channels; 

Case #2: right stabilator locked at -4 degree at t=40 s, no pilot input; 
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Case #3: right stabilator locked at -4 degree at t=40 s, doublets on all three channels, before and 
after the failure; 

Case #4: right stabilator locked at +8 degree at t=40 s, no pilot input; 

Case #5: left canard locked at -4 degree at t=40 s, no pilot input; 

Case #6: left canard locked at -4 degree at t=40 s, doublets on all three channels, before and after 
the failure. 

The mean values and the standard deviations of the errors between reference model 
angular rates and actual aircraft angular rates have been computed for assessing the performance 
of the different approaches. The results for the roll, pitch, and yaw channels are presented in 
Tables 1-3, respectively. 

The NLDI-based controller is coping with the failure in all the cases investigated except 
Case #4. A similar behavior is recorded for the Sigma Pi augmented version. The EMRAN and 
SHL augmented versions can handle all the cases investigated. 

On the roll and pitch channel the best performance are achieved using the EMRAN NN 
with the SHL-augmented and the SP-augmented control laws ranking second and third 
respectively. 

On the yaw channel the SHL-augmented control laws outperform the others. 

As an example. Figure 1 shows the time histories of the square of the pitch rate tracking 
errors for the three NNs and with the NN off for the stabilator failure case (case #2). A similar 
plot is presented in Figure 2 for the canard failure case (case #5). The time histories of the square 
of the roll rate tracking errors for the same two cases are shown in Figure 3 and 4 respectively. 

2.7. Conclusions 

The performance associated with the augmentation of 3 different NNs for the ‘Gen_2’ 
Dl-based control laws have been compared. The neural augmentation is designed to assist the DI 
control laws at post failure conditions. 

Different failure scenarios for the EFCS FI 5 stabilators and canards have been 
investigated. Each of the considered neural algorithms has shown to provide successful 
augmentation of the Dl-based control laws leading to better dynamic responses at post failure 
conditions - compared with the NN off case. 

The results shown that the EMRAN algorithm slightly outperforms the other two 
algorithms in terms of the angular rate tracking errors, while requiring a lower computational 
effort. 
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3. Safety monitor schemes for transition to research control laws 

3.1 Introduction 

The IFCS F-15 ‘ Gen_2 ’ control laws are based on the use of NNs to augment a NLDI 
based controller 1,16,17 . The role of the NNs is to compensate for inversion errors and changes in 
aircraft dynamics due to the injection of the failure on a primary control surface. In this 
document this set of control laws will be referred to as the "research control laws" (RCL), while 
the basic (background) control laws will be denoted as the "conventional control laws" (CCL). 
The RCL are implemented on a dedicated "research flight computer" (RFC) - the ARTS2 on- 
board computer - while the CCL are installed on the "basic flight computer" (BFC) - the SC3 
on-board computer. 

The flight testing of the RCL implies the switching by the pilot at a certain instant from 
the CCL to the RCL at nominal conditions and - at a later instant - the switching from the RCL 
at nominal conditions to the RCL with simulated failures on specific control surfaces. The risks 
associated with these transitions and the need for a logic to decide whether the transitions can be 
safely performed have been acknowledged within the flight control testing community 18 ' 20 . 

In recent years, flight control systems for different test aircraft have been provided with a 
scheme to monitor the safety of the transitions described above (e.g. F-16 Variable Stability In- 
Flight Simulator Test Aircraft - VISTA and F/A-18 High Angle of Attack Research Vehicle - 
HARV). 

The specific characteristics related to the operation under simulated control surface 
failure have led to the development of two different sub-schemes (SM#1 and SM#2). Their logic, 
for the different transitions, uses information relative to different parameters, such as flight 
conditions and controller-related performance criteria. 

3.2. Description of the “Safety Monitor” Scheme 

At any point in the flight envelope the aircraft control laws are assumed to be in one of 
the following modes: 

• Nominal Mode (NM) 

• Research Mode (RM) 

• Simulated Control Surface Failure Mode (FM). 

The existence of these distinct modes of operation implies the need for a total of five 
different switch logics: NM to RM and back, RM to FM and back, and FM to NM. Note that the 
direct transition from NM to FM is not allowed. The issues and the risks related to these 
transitions are different; therefore, two separate safety monitor schemes have been developed 
(SM#1 and SM#2). In particular, the SM#1 scheme handles the transition from NM to RM while 
SM#2 handles the remaining transitions. 

3.2.1. Operation Modes 

The characteristics of the three operating modes of the IFCS F-15 aircraft during the test 
flight are as follows: 

- Nominal Mode (NM): the conventional control laws (CCL) implemented in the basic flight 
computer (BFC) are active and the SM#1 decides whether transition to Research Mode (RM) is 
safe. The test flight is initiated in the NM. 

- Research Mode (RM): the research control laws (RCL) implemented in the research flight 
computer (RFC) are active and the SM#2 decides whether the transition to Simulated Failure 
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Mode (FM) is safe - OR - the RM should be maintained - OR - the RM should be aborted with 
re-engagement of the NM mode. 

- Simulated Control Surface Failure Mode (FM): the RCL implemented in the RFC are active 
and a failure of a primary control surface is simulated. The control surface subjected to the 
simulated failure is selected by the pilot. The SM#2 decides whether maintaining the FM is safe 

- OR - the simulated failure should be disengaged - AND - either the RM or the NM should be 
re-engaged. The re-engagement of the RM or the NM is performed automatically by the SM. 

3.2.2. Abnormal Situations 

The decisions by the two SMs are based on the analysis of a large set of dynamic 
parameters selected to provide detectability of abnormal situations which do not allow the safe 
operation of the RFC and the RCL under nominal and/or failure conditions. Such abnormal 
situations include failures of various aircraft sub-systems (other than the control surfaces), 
suspect functioning of different sub-systems, and operations at unsafe flight conditions. 

The abnormal situations have been grouped in nine categories. In general, a "red" or a 
"green" flag is associated to each category depending on whether abnormal situations exists or 
not. 

Category # 1 - any failure for the Flight Control System (FCS) (including sensor failures 
and actuator failures - for other surfaces excluding stabilators and canards), the propulsion 
system, the electrical system, etc. The SM is provided with failure flags from distinct failure 
detection and identification (FDI) schemes. 

Category #2 - failures reported from the RFC. The failure flag is generated and sent to 
the SM by a failure detection scheme associated with the RFC. 

Category #5 - exceedance of a pre-assigned flight envelope within which the flight 
testing should be restricted. The allowed flight envelope is defined in terms of Mach number and 
altitude. 

Category # 4 - aircraft dynamic characteristics exceeding certain pre-imposed limits. The 
dynamic characteristics considered are: linear accelerations, angular rates, angle of attack, and 
sideslip angle. 

Category #5 - inappropriate aircraft configurations for safe flight testing, such as center 
of gravity exceeding certain ranges, low levels of fuel, landing gear up, flaps up, speed brakes 
up, etc. 

Category #6 - failures of the data communication bus. 

Category #7 - inaccurate tracking of commanded angular rates due to poor performance 
of the BCL. Since in this study both CCL and RCL feature command augmentation systems, it is 
appropriate to use tracking information for assessing normal/abnormal operations. In particular, 
both the tracking errors and their rates are expected to remain within certain limits on all three 
channels (roll, pitch, and yaw). The bounds are variable and are computed based on statistics of 
the signals using a "Floating Limiter" (FL) concept outlined in the next section. 

Category #8 - excessive control activity for primary control surfaces (without the 
injection of the failure). Individual control surfaces are considered (left and right stabilator, 
canard, aileron, and rudder). A floating limiter augmented with a saturation proximity limiter is 
used. Additionally, or as an alternative, the pseudo-control hedging 21,22 (PCH) activity can be 
used as an index of normal/abnormal operation of the control surfaces. 

Category #9 - excessive levels of activity for the NNs augmenting the NLDI controllers. 
The activity of the NN is evaluated in terms of the sum of the NN weights, the sum of the 
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updates of the NN weights, and the NN outputs. For the three channels, this adds up to a total of 
nine signals that are provided as inputs to floating limiters, respectively. 

It should be emphasized that categories #1 to #6 can be associated only with "green" or 
"red" flags. For categories #7 to #9 the floating limiter can be used to generate cautionary and 
failure bounds. If ‘cautionary bounds’ - later defined - are exceeded, then a "yellow" flag is 
declared. If ‘failure bounds’ - also later defined - are exceeded, then a "red" flag is declared 
instead. The particular actions taken by the SM as a consequence of these different flags are 
described in §3.2.4 and §3.2.5. 

It is assumed that the abnormal situations relative to categories #1, #2, #5, and #6 are 
detected by other FDI schemes, while the rest of the categories are assessed using the SM 
presented in this paper. 

3.2.3. Floating Limiter 

The logic of the SM scheme is based on the use of the "Floating Limiter" (FL) concept. 
The FL uses statistical parameters of a signal to compute upper and lower bounds of die 
acceptable domain of operation. This domain has two levels of boundaries, that is cautionary and 
failure bounds. When these bounds are exceeded, the SM takes the actions described in the next 
section. The signal to be monitored along with its derivative are filtered to obtain approximations 
of their average values and standard deviations. Then, the cautionary upper and lower bounds 
(CUB and CLB, respectively) along with the failure upper and lower bounds (FUB and FLB, 
respectively) are computed using the relationships: 

CUB(x) = x + b c • o(x) + bias 

CLB(x) = x - b c • a(x) - bias (25) 

FUB(x) = x + b f • a(x) + bias 
FLB(x) = x - b f • a(x) - bias 

where 3c is the average value of x,cr(x) is the standard deviation of x, b c is the cautionary bound 
factor, b f is the failure bound factor. Similar relationships are used for the derivative of x. 

In order to declare a failure or a cautionary situation, the respective bounds must be 
exceeded for a number of times n over a time window of width t ^ . This will prevent false 

alarms following accidental bound exceedence due to perturbations and/or noise. 

When a simulated control surface failure is engaged, the parameters involved in the 
categories #7, #8, and #9 exhibit relatively large transients. This will usually determine the 
exceedence of the bounds and the disengagement of the simulated failure. To avoid such a 
situation the bounds computed in (25) are relaxed for a duration t re , following the moment the 
failure is engaged. This is achieved by allowing larger values for the bound factors ( b c ,b f ) and 
the bias. 

The block diagram of the floating limiter is presented in Figure 5. The Simulink scheme 
of the floating limiter is shown in Figure 6. It is used as a building block for the SM components 
assessing abnormal situations in the categories #7, #8, and #9. 
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3.2.4. Subscheme#! (SM#1) 

The SM #1 has the objective of supervising the transition from the CCL and the BFC to 
the RCL at nominal conditions and the RFC, in other words the transition from NM to RM. 
SM#1 operates only while the aircraft is in NM and monitors the occurrence of abnormal 
situations in the categories #1 to #7. If all the flags are "green" then the transition from NM to 
RM is allowed and can be performed if the pilot wishes to do so. If any of the flags is "red" or 
the category #7 flag is "yellow" then the transition from NM to RM is not allowed and the flight 
must continue in NM. Figure 7 shows the block diagram relative to the SM#1. 

3.2.5. Subscheme #2 (SM#2) 

The SM#2 has the task of supervising all the other four possible transitions except the 
transition from NM to RM. SM#2 operates while the control laws are in RM and FM. It 
monitors the occurrence of abnormal situations in the categories #1 to #9. 

Consider the test aircraft in RM. If all the flags are "green" then the transition from RM 
to FM is allowed and a simulated primary control surface failure can be engaged at any time by 
the pilot. The pilot can also select to switch back to NM. If any of the flags is "red" then the 
SM#2 will automatically switch back to NM, disengage the RCL/RFC, and reengage CCL/BFC. 
If any of the flags of categories #7 to #9 is "yellow" the transition from RM to FM is not 
allowed; however RM is allowed to continue. 

If the test aircraft is in FM and all the flags are "green" then it is safe to continue to FM. 
The pilot can of course switch back to RM or NM at any time. If any of the flags is "red" then 
the SM#2 will automatically switch back to NM. If any of the flags of categories #7 to #9 is 
"yellow" then the SM#2 will disengage the simulated failure and switch back to RM. 

Figures 8 and 9 illustrate the operation of the SM#2 while the control laws are in RM and 
FM, respectively. 

3.3. Description of the IFCS F-15 Simulation Code 

The Matlab/Simulink based WVU IFCS F-15 Simulation Code features a non-linear 
model of the NASA F15 dynamics featuring a set of look-up tables describing the aerodynamic 
characteristics of the aircraft. Failures of the primary control surfaces are modeled using an 
approach based on a modification of their aerodynamic efficiency at post-failure conditions 53,24 . 
Each of the eight individual control surfaces can be ‘artificially’ failed with the following 
options: 

- surface lockage (stuck actuator) 

- partial/total destruction of the surface along surface lockage (stuck actuator). 

The conventional control laws are generated using a non-linear dynamic inversion 
(NLDI) based approach. The research control laws are obtained using an adaptive neural 
controller canceling the errors associated with the dynamic inversion of the aircraft model. 
Desired characteristics in terms of second order responses for the pitch and directional channels 
and first order response for the roll channel are achieved with "ad hoc" reference models A PCH 
scheme is added to reduce the effects of control saturation. As described in the previous section 3 
different types of NNs are implemented (SigmaPi, EMRAN and Single Hidden Layer NN) and 
can be selected by the user. The values of aerodynamic stability and control derivatives required 
by the dynamic inversion algorithm can be either kept constant throughout the simulation, 
corresponding to the initial equilibrium flight condition, or can be updated using a pre-trained 
NN as the aircraft moves in the flight envelope. This control strategy has been selected to 
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provide consistent handling qualities without requiring the level of computational effort 
associated with gain-scheduling or system identification. 

Figure 10 shows the main Simulink scheme of the WVU IFCS F-15 ‘Gen_2 ’ Simulation 

Code. 

3.4. Description of the Interface Between the SM Scheme and the WVU IFCS F-15 
Simulator 

The user can set the desired simulation scenario through interactive menus. Either 
nominal flight conditions or failure conditions can be selected. The nominal flight scenario 
includes only NM and RM thus allowing switching to and from RCL/RFC and CCL/BFC. These 
actions can be performed by the simulation pilot using the main SM switch (shown in Figure 11). 
During nominal flight only abnormal situation in the categories #3, #4, and #7 can occur. The 
"flight with failures" scenario allows operation in the Simulated Control Surface Failure Mode 
(FM). When FM is engaged by the pilot from the main SM switch, a failure of previously 
imposed magnitude on the previously selected control surface occurs. Switching back to RM or 
NM as a result of pilot or SM action will disengage the failure. Unlike this "simulated" failure, a 
permanent, "real" failure of one of the control surfaces can also be implemented. Its magnitude 
and time of occurrence is selected by the user before the simulation. When it occurs and is 
properly detected, the SM declares an abnormal situation of category #1 and takes appropriate 
action (see Section 3.2). The occurrence of other "real" abnormal situations in the categories #1, 
#2, #5, and #6 can be imposed at specified times using the failure menu shown in Figure 12. The 
flags of the abnormal situations are shown during the simulation using the color code (red, 
yellow, green) as described previously (see Figure 13 for SM#1 and Figure 14 for SM#2). 

The parameters of the floating limiter can also be set by the user. Figure 15 shows the 
corresponding menu with the values used for this study. 

The time histories of all the different parameters and flags related to the categories #7, 
#8, and #9 (tracking errors, control deflections, sum of NN weights and their update rate, NN 
output) can also be displayed during or after the simulation. The scopes to be displayed can be 
selected through the menu shown in Figure 16. 

3.5. Simulation Results for Different Scenarios 

To illustrate the operation of the SM scheme, the results for two different scenarios have 
been included. 

Scenario # 1 . The first simulation case consists of a series of smooth maneuvers (doublets 
on the three channels) during the three operation modes without exceeding the bounds of any 
abnormal situation. During the first 20 seconds, the aircraft is in NM; for the next approx. 20 
seconds the aircraft is in RM. At this time, a simulated failure on the right stabilator is engaged 
(locked stab at -4 degrees). The aircraft remains in FM until approximatively t=65 s while 
doublets on all three channels are performed. Next the pilot switches back to RM and the failure 
is disengaged. After 10 seconds the failure is re-engaged for an other 10 seconds after which the 
pilot returns to NM. Figures 17 and 18 show the variation of the left and right stabilators, 
respectively, within the variable cautionary and failure bounds. Note the presence of the failure 
on the right stabilator. The acceptable bounds are not exceeded except for short periods of time, 
which does not trigger the declaration of an abnormal situation. Throughout the entire simulation 
the SM performs as expected. 
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Scenario #2. The second simulation case includes more demanding pilot inputs that 
would trigger exceedence of abnormal situations bounds and thus limiting actions from the SM 
scheme. At 15 s, 30 s, and 50 s the RM is engaged but, after a transient, the acceptable limits of 
the control activity parameters (category #8) are exceeded; thus, SM#1 switches back to NM. At 
t=60 s the aircraft is in RM again and at t=70 a simulated failure of the right stabilator (locked at 
-4 degree) is engaged. At t=75 s the cautionary bounds of category #8 are exceeded and the 
failure is disengaged while the RM is still maintained. Shortly after, the failure bounds are 
exceeded as well and a switch back to NM is commanded by the SM#2. Figures 19 and 20 show 
the deflections of the left and right stabilators, respectively, within the variable cautionary and 
failure bounds. SM#2 detects that the exceedence of the acceptable bounds has occurred (see 
Figure 23 for the variation of category #8 flag). Figures 21 and 22 show a typical category #8 
abnormal situation due to excessive canard activity. 

Even in this case, the SM scheme performed as expected in all situations. 

3.6. Simplified SM scheme 

During the design, a large number of parameters have been investigated as candidates for 
safety monitor purposes. Following interaction with the technical monitor, the need to reduce the 
complexity of the scheme and to simplify the validation task led to a reduction of the signals 
monitored. Eventually only the angular tracking error of the angular rates (3 signals) and the NN 
output (3 signals) have been considered. The monitoring of these parameters is based on the 
concept of floating limiter augmented with a range check and persistence counters. 

3.6.1. Simplified floating limiter 

The FL has some unique features which allow full authority and rates within a window, 
but rate limits if the input signal persists in one direction for preventing a hardover from coming 
through to the control system. The logic of the SM scheme is based on the use of the FL concept 
as shown in Figure 24. The FL works by computing the rate of change of the input signal to be 
tested. Upper and lower bounds are placed on the input signal and a drift rate is applied to the 
FL. The FL will try to center about the input signal and drift with it at a rate equal to the rate of 
the signal but less than an imposed limit. High rate of changes are permitted only within floating 
limiter upper and lower bounds. 

The upper bound (UB) at time step ' is: 


UB(n) = min 


r s(n)+A(s) N 

,UB(n - 1) + (s) x fan) - t(n - 1)], 


The lower bound (LB) at time step ‘w ’ is: 


LB(n) = max 


^s(n)-A(s) N 

v UB(n -1)-^ (s) x [t(n) - t(n - 1)], 


(26) 


(27) 
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where 4 A ’ represents the range within which the signal is allowed to vary at any rate, and R max 
represents the maximum rate at which the bounds are allowed to vary. Both these parameters 
depend on the nature of the input signal but are constant in time. Figure 25 shows an example of 
the input signal changing in the positive direction at the maximum rate of the FL; therefore, it 
can keep up with the signal and remain centered. The signal then changes in the negative 
direction at a rate greater than the FL. The drift rate of the FL cannot keep up and the signal 
approaches the FL lower bound. Before it reaches the FL lower bound, it changes at a high rate 
in the positive direction. The FL reverses direction, again. Finally, the input signal reaches the 
upper bound of the FL and is ‘clamped’ to this value. A persistence counter starts at the moment 
the bound is reached. For this example, the persistence counter limit is 3 and a red flag (down 
mode from RCL to CCL) is set. If the input signal had reversed before the persistence counter 
limit was reached, the counter would have reset back to zero. 

3.6.2. Range Limiter 

A range monitor is used to check signals that change at a slow rate, which the FL would 
not detect. In other words, if the monitored signal varies at a low rate it could grow indefinitely. 
To avoid such situation, the FL is augmented with a range check. This will limit the values of the 
FL bounds at imposed constant values. 

3.6.3. Persistence Counter 

As soon as a bound is reached, the monitored signal is limited. However, in order to 
avoid a large number of nuisance disengagements, the operation is allowed to continue as before. 
Down mode is not triggered unless the bounds are exceeded for a selected time interval (in 
Figure 25 this interval is ‘3’ sampling steps). The persistence counter totals the number of 
consecutive hits, then a flag is sent to down mode to CCL when the limit is reached. 

3.6.4 Reduced number of parameters monitored 

Two categories of parameters have been investigated for safety monitor purposes in this 
study. The first are parameters related to the tracking error (TE) of the angular rates. The second 
are the parameters related to the operation of the NNs. 

The tracking error parameters were the statistics of the TE (mean and standard deviation) 
and the TE itself. Initially, both these signals and their variation rate were considered. For the 
three channels (roll, pitch, and yaw) this adds up to a total of 18 different signals. 

The NN parameters considered initially were the NN output, the sum of the NN weights, 
and the sum of die NN weight update rates. These parameters and their rates add up to a total of 
18 monitored signals. 

The variation of the FL metrics for these monitored signals have been determined with 
the goal to achieve maximum "correct detection'V'false alarm" ratios. Through extensive 
simulation it has been determined that none of these parameters is redundant. Any of the 
monitored parameters can be the first to detect an abnormal situation. To illustrate this point, two 
control surface failure cases are shown in Figures 26-29. In case #1 the NN output based 
criterion detects the abnormal situation while the sum of the NN weights fails. In case #2 
however, the situation reverses. 

The need to reduce the complexity of the scheme and to simplify the validation task has 
lead to a reduction of the signals monitored. Only the angular tracking error of the angular rates 
(3 signals) and the NN output (3 signals) have been considered. Abnormal situations will be 
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reflected in this set of parameters. Monitoring more signals can reduce the time of detection, but 
this effect can also be achieved by appropriate tuning of the FL parameters at the expense of 
increased false alarm rate. 

3.6.5. Testing of the simplified scheme 

To illustrate the operation of the SM scheme a 20 sec simulation has been performed 
which included input doublets of moderate amplitude on all three channels. At time=7 sec the 
right stabilator is locked at the current trim position plus 4 degrees. At time=15 sec the simulated 
failure is disengaged. Note that all the parameters of the SM used here were tuned only for test 
purposes and to provide an example of the operation of the SM. 

The time histories of the safety monitor flags on the roll channel are presented in Figure 
30. The range check flag of the roll rate tracking error turns 'red' (=is set to 1) at time=9.1625, 
that is 0.125 sec after the range limit is exceeded (see Figure 31). It becomes 'red again at 
time=15.15 due to the exceedence of the FL limits (see Figure 31). Figure 32 shows the 
operation of the FL on the NN output on the roll channel. The FL upper bound is exceeded at 
t=15.275 and the corresponding flag turns 'red" at t=15.4. The ‘clamping’ of the signals occurs 
as expected for both the tracking error (Figure 33) and the NN output (Figure 34). Note that the 
‘clamping’ of the signal is not subject to the persistence condition and it is performed as soon as 
the limits are exceeded. 

3.7. Conclusions 

A general Safety Monitor (SM) scheme has been designed to ensure safety while 
evaluating experimental control laws. A comprehensive set of abnormal situations has been 
assessed based on external and internal detection schemes. The resulting safety monitor scheme 
uses a floating limiter with double level limits to determine acceptable variable bounds for 
significant parameters, based on past time histories and statistics. Throughout extensive 
simulations, the approach has shown to be efficient and reliable. 

The simulations of two different flight scenarios have been performed using the WVU 
IFCS F-15 Simulink based simulator. In both cases, the SM scheme has provided very desirable 
performance. 

A simplified monitor scheme has been designed with only 6 parameters and a single level 
floating limiter. Issues related to the reduction of the scheme complexity have been analyzed 
extensively with the technical monitor. 

The design concept of the FL allows tuning for the particular input signals. The upper 
and lower boundaries, drift rate, and persistence counter limit can be adjusted in real time as 
necessary according to the simulated failure dynamics. 

The operation of the scheme has been tested through simulation and the approach has 
shown to be efficient, reliable, and easily tailored to specific applications including simulated 
failures in a piloted simulation environment. 
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4. Modifications to Remove Cross-Coupling Issues 
on the IFCS F-15 Control Laws 


4.1. Introduction 

In late Fall 2003 reports from the pilot in the NASA simulator indicated that a persistent 
cross coupling induced by stabilator failure was present at post-failure conditions. The solution 
proposed by WVU researchers for reducing the dynamic coupling was based on the introduction 
of coupling terms (CCT) in the cost function of the neural networks. Therefore, products of the 
angular rates and angular rate cross correlations have been considered as possible coupling terms 
to be added to the cost function. 

4.2. Cross-coupling parameters 

Non-zero products of the angular rates naturally reflect the occurrence of a dynamic 
coupling. The use of the coefficients of the cross correlation function has also been investigated 
for the same purpose. This may still be a path worth searching although preliminary results did 
not show too much difference. However, the cross correlation is used to assess the “amount” of 
coupling and the performance of the scheme. 

If the tracking would be perfect, there would be no coupling. Therefore, the tracking error 
part of the cost function should have a large numerical weight, and the coupling term should 
enhance its effect. Thus, cross-coupling terms are added to the tracking error to form the cost 
function of the NN. For the roll, pitch, and yaw channels respectively the cross-coupling term is 
expressed as: 

k r0lf|pq|-sign(p err ) 

k P itch|p-q|-sign(q 

err ) (28) 

k yaw-| r q|sign(p elr ) 

where ‘p’, ‘q’, and ‘r’ are the angular rates, the k’s are proportional gains, and p err and q^. are 

roll and pitch rate tracking errors. It has been noticed that occasionally the coupling terms would 
tend to “fight” the tracking error since they might have different sign; therefore, an adaptive sign 
for the coupling term has been introduced by multiplying the absolute value of the coupling term 
with the sign function of the tracking error. It should be underlined that a drawback of this 
approach is the possibility of discontinuities (jumps) in the cost function whenever the tracking 
error changes sign. No adverse effect has been noticed in the limited amount of simulations 
performed; however, a smoothing filter could be introduced to handle this problem. 

4.3. Simulation results 

4.3.1. Test Case #1 

Failure: +4 deg right stab at t=10 sec, removed at t=20 sec. Augmenting NN: SHL. Mach=0.75. 
Pilot input: doublets on pitch channel only 

Table 4 presents the statistics (mean and standard deviation) of the tracking error as a 
measure of the performance of the scheme in 3 distinct situations: 

- NN off 

- SHL-NN on without cross-couplig terms (CCT) 

- SHL-NN on with cross-couplig terms (CCT). 
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It should be noted that there are no significant reduction in the mean; however, this 
parameter was small from the beginning. On the other side there is significant reduction in the 
standard deviation for SHL-NN on with the CCT as compared to the “NN off’ case and the 
“SHL-NN on without CCT” case. These results are illustrated in Figures 35-37. 

Table 5 presents the effects of adding CCT terms on the cross-correlation. Slight 
performance deteriorations can be observed in terms of pitch/yaw dynamic coupling. However, 
this coupling was negligible to start with. On the other side, a significant reduction is obtained 
for the roll/pitch coupling. These results are illustrated in Figures 38-40. 

4.3.2. Test Case #2 

Failure: +4 deg right stab at t=10 sec, removed at t=50 sec 

Augmenting NN: SHL. Mach=0.75. Pilot input: doublets on pitch channel only. 

Improvements in the statistics of the tracking error (see Table 6) and in the cross- 
correlation parameter (see Table 7) are observed. These improvements are better than those 
achieved for Case #1. However, the absolute values of the parameters monitored are reduced. 
Figures 41 to 43 show the time histories of the square of the angular rate tracking errors. Figures 
44 to 46 show the time histories of the angular rate cross correlations. 

4.3.3. Test Case #3 

Failure: right stab locked at trim, at t=10 sec 

Augmenting NN: SHL. Mach=0.75. Pilot input: doublets on pitch channel only 

The statistics of the tracking errors are presented in Table 8. The effect of the CCT in 
term of percentual variation of the angular rate cross correlation is presented in Table 9. There is 
no improvement but the considered parameters (tracking error and CC parameter) have very low 
values as compared to the two previous cases. 

4.4 Conclusions 

Cross-coupling terms have been defined in terms of weighted cross products of the 
angular rates to be added to the cost function of the NN to improve the cross axes response. An 
adaptive sign was introduced to avoid counteracting actions by the tracking error and the CCT. 
The addition of the adaptive sign actually improve the performance substantially. 

Simulations show performance improvement in terms of cross-coupling reduction 
evaluated by means of angular rate cross-correlation and tracking error. 
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NN off 

EMRAN 

SigmaPi 

SHL 


Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Case #1 

0.0182 

4.4121 

-0.0006 

3.4229 

-0.0086 

6.2877 

-0.0003 

4.0883 

Case #2 

-0.1369 

1.3007 

-0.0002 

0.8416 

-0.0411 

1.6936 

-0.0003 

0.9167 

Case #3 

-0.0974 

4.9750 

-0.0028 

4.0092 

-0.0086 

6.2877 

- 0.0000 

5.3922 

Case #4 

unstable 

unstable 

-0.0004 

1.3014 

unstable 

unstable 

-0.0024 

1.5490 

Case #5 

0.0133 

0.1694 

-0.0001 

0.1640 

0.0087 

0.1893 

-0.0001 

0.1549 

Case #6 

0.0303 

4.2208 

0.00002 

3.4009 

0.0054 

3.7050 

-0.0002 

3.0629 


Table 1. Performance Parameters on the Roll Channel for the Three NNs 



NN off 

EMRAN 

SigmaPi 

SHL 


Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Case #1 

0.0399 

0.5059 

0.0055 

0.5948 

0.0100 

0.9903 

-0.00002 

0.6785 

Case #2 

-0.0651 

0.8689 

-0.00001 

0.4959 

-0.0180 

0.7122 

-0.00003 

0.5031 

Case #3 

-0.0446 

1.0112 

-0.0334 

0.8536 

0.0100 

0.9903 

0.0000 

0.9599 

Case #4 

unstable 

unstable 

0.9113 

0.8593 

unstable 

unstable 

0.5288 

0.8285 

Case #5 

0.0502 

0.2589 

- 0.0000 

0.1813 

0.0075 

0.2806 

- 0.0000 

0.1900 

Case #6 

0.0037 

0.6640 

0.0005 

0.4781 

0.0001 

0.6267 

-0.0001 

0.5094 


Table 2. Performance Parameters on the Pitch Channel for the Three NNs 



NN off 

| EMRAN 

SigmaPi 

SHL 


Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Mean 

[deg/s] 

STD 

Case #1 

-0.0040 

1.6987 

0.0077 

2.5394 

-0.0033 

1.7476 

- 0.0000 

0.8324 

Case #2 

-0.0178 

0.2168 

- 0.0000 

0.1577 

-0.0088 

0.2506 

-0.0001 

0.1676 

Case #3 

-0.0093 

1.6516 

0.0023 

2.5565 

-0.0033 

1.7476 

-0.0001 

1.0185 

Case #4 

unstable 

unstable 

-0.00003 

0.2715 

unstable 

unstable 

0.00006 

0.3673 

Case #5 

-0.0156 

0.1559 

-0.0001 

0.1531 

-0.0097 

0.1603 

-0.0001 

0.1518 

Case #6 

-0.0192 

1.7560 

0.0049 

2.5586 

-0.0112 

1.8180 

-0.0001 

1.0121 


Table 3. Performance Parameters on the Yaw Channel for the Three NNs 
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NN off 

SHL+CCT 

SHL 

Roll Channel 

Mean 


-0.1030 

0.0107 

STD 


4.8250 

5.6282 

Pitch Channel 

Mean 

0.0004 

-0.0017 

-0.0014 

STD 

1.2662 

1.0204 

1.0339 

Yaw Channel 

Mean 

-0.5032 

-0.3335 

-0.2017 

STD 

1.1037 

0.6142 

0.7103 


Table 4. Effect of Cross-Coupling Terms Addition - Tracking Error Statistics - Test Case #1 



NN off 

SHL 

SHL+CCT 

Roll/Pitch 

100% 

79% 

62% 

Pitch/Yaw 

100% 

97% 

117% 

Roll/Yaw 

100% 

78% 

64% 


Table 5. Effect of Cross-Coupling Terms Addition - Maximum Cross-Correlation - Test Case #1 




NN off 

SHL+CCT 

SHL 

Roll Channel 

Mean 

0.0653 

0.0597 

0.0522 

STD 

8.6856 

6.1325 

6.8776 

Pitch Channel 

Mean 

0.0004 

0.0148 

0.0007 

STD 


1.1935 

1.2168 

Yaw Channel 

Mean 

-2.1851 

-0.4973 

-0.8416 

STD 

1.5951 

0.8350 

0.9312 


Table 6. Effect of Cross-Coupling Terms Addition - Tracking Error Statistics - Test Case #2 



NN off 

SHL 

SHL+CCT 

Roll/Pitch 

100% 

77% 

58% 

Pitch/Yaw 

100% 

64% 

44% 

Roll/Y aw 

100% 

78% 

64% 


Table 7. Effect of Cross-Coupling Terms Addition - Maximum Cross-Correlation - Test Case #2 




NN off 

SHL+CCT 

SHL 

Roll Channel 

Mean 

-0.0026 

0.0041 

-0.0017 

STD 

2.2326 

2.4536 

2.3890 

Pitch Channel 

Mean 


mmmm 

-0.0002 

STD 

EXSBIHIH 

HMsam mm 

0.7374 

Yaw Channel 

Mean 

-0.0120 

0.0015 

-0.0014 

STD 

0.1288 

0.1762 

0.1580 


Table 8. Effect of Cross-Coupling Terms Addition - Tracking Error Statistics Test Case #3 
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NN off 

SHL 

SHL+CCT 

Roll/Pitch 

100% 

109% 

116% 

Pitch/Yaw 

100% 

127% 

133% 

Roll/Yaw 

100% 

125% 

144% 


Table 9. Effect of Cross-Coupling Terms Addition - Maximum Cross-Correlation - Test Case #3 
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Figure 1. Comparison of the three NNs - 
Stabilator failure at t=40s - Pitch Channel 
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Figure 3. Comparison of the three NNs 
Stabilator failure at t=40s - Roll Channel 
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Figure 2. Comparison of the three NNs - 
Canard failure at t=40s - Pitch Channel 
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Figure 4. Comparison of the three NNs - 
Canard failure at t=40s - Roll Channel 
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Figure 6. Simulink Implementation of the Floating Limiter 
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Nominal Mode 



Figure 7. Block Diagram of the Safety Monitor Scheme #1 (SM#1) 


Research Mode 
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Research Mode 


Failure Mode 
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Figure 10. Simulink Scheme of the IFCS FI 5 Simulation Code 
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Figure 11. On Board Computer Master Switch 


Figure 12. Failure Conditions Menu 
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Figure 13. Abnormal Situations - 

Figure 14, Abnormal Simations - 

Category Flags for SM# 

1 

Category Flags for SM#2 


29 


miVQ&G Km 

Hammy lam**- Mmnu 

4jh * «rir»> * S l O *f f+*« 

MJHimAL OUtlCllTiGIlS 



Figure 15. Floating Limiter Parameters 



Figure 17. Time Histories of Left Stabilator 
Deflection Along with Variable Cautionary 
and Failure Limits Case #1 



Figure 16. Safety Monitor Visualization Menu 
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Figure 18. Time Histories of Right 
Stabilator Deflection Along with Variable 
Cautionary and Failure Limits - Case 1 
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Figure 19. Time Histories of Left Stabilator 
Deflection Along with Variable Cautionary 
and Failure Limits - Case 2 



Figure 20. Time Histories of Right 
Stabilator Deflection Along with Variable 
Cautionary and Failure Limits - Case 2 
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Figure 21. Time Histories of Right Canard 
Deflection Along with Variable Cautionary 
and Failure Limits - Case 2 
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Figure 22. Detail of Right Canard 
Deflection Time History Showing a 
category #8 Abnormal Situation - Case 2 



Figure 23. Time History of the Category #8 Flag - Case 2 
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Figure 24. Floating Limiter Logic Block 
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Figure 26. Case #1 - “red” flag due to exceedance 
of the “NN output” bounds 


Figure 27. Case #1 - the sum of the weights 
does not exceed the bounds 
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Figure 28. Case #2 - the NN output does not 
exceed the bounds 
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Figure 29. Case #2 -“red” flag due to 
exceedance of the “NN weights” bounds 
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Figure 30. Safety Monitor Flags Roll Rate 
Tracking Error 


Figure 31. Floating Limiter and Range 
Check for the Roll Rate Tracking Error 
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Figure 32. Floating Limiter for the Neural 
Roll Channel 
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Figure 33. Clamping of the Roll Rate Network Output on the 
Tracking Error 
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Figure 34. Clamping of the Neural Network Output 
on the Roll Channel 
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Figure 35. Effect of CCT on the Tracking 
Error - Roll Channel - Case #1 





Figure 36. Effect of CCT on the Tracking 
Error - Pitch Channel - Case #1 
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Figure 37. Effect of CCT on the Tracking 
Error - Yaw Channel - Case #1 
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Figure 38. Effect of CCT on the Roll-Pitch 
Cross-Correlation - Case #1 


R*?« SHfc f «M« t^lUr tomm y a rt m K5* - %q 



Figure 39. Effect of CCT on the Pitch-Yaw 
Cross-Correlation - Case #1 
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Figure 40. Effect of CCT on the Roll-Yaw 
Cross-Correlation -Case#l 


34 




Figure 41. Effect of CCT on the Tracking 
Error - Roll Channel - Case #2 
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Figure 42. Effect of CCT on the Tracking 
Error - Pitch Channel - Case #2 
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Figure 43. Effect of CCT on the Tracking 
Error - Yaw Channel - Case #2 





Figure 44. Effect of CCT on the Roll-Pitch 
Cross-Correlation - Case #2 



Figure 45. Effect of CCT on the Pitch-Yaw Figure 46. Effect of CCT on the Roll-Yaw 

Cross-Correlation - Case #2 Cross-Correlation - Case #2 
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